Issue with Microsoft Intune Company Portal for Linux visibility in Enterprise Applications

Hey,

thanks again but I now got an additional problem. I assigned a security attribute for Conditional access but I am still getting blocked by CA. Looks like it is not recognized. However I tried to exclude that app from CA but in the GUI I can't find/select it. When I try to add directly via graph API I get this response:

Any ideas how I can exclude this app from default block rule?

{
    "error": {
        "code": "BadRequest",
        "message": "1034: Policy contains invalid applications: {\"2c788fb4-38d5-4c20-9064-d0e62578ffb2\":\"ServicePrincipalNotFound\"}",
        "innerError": {
            "date": "2025-03-07T23:24:30",
            "request-id": "1bdd22fc-xxxx-xxxx-xxxx-76e772e94053",
            "client-request-id": "xxxxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
        }
    }
}

Hello @Niederauer,Till (IT INF) BIG-DE-I,

Thank you for your response.

I understand that even after creating a Service Principal for the application Microsoft Intune Company Portal for Linux in your Tenant B, when you are trying to exclude this application Microsoft Intune Company Portal for Linux from the CA policy, you are unable to find the application.

Please note that since Azure AD PowerShell is currently in deprecation stage, so we would recommend you to use Microsoft Graph PowerShell instead of Azure AD PowerShell. Please follow the below steps.

1.Open PowerShell as an Administrator.

2.Install Microsoft Graph Module. Run the following command to install the Microsoft.Graph module.

Install-Module Microsoft.Graph

3.Import Microsoft Graph Module by running the below PowerShell command.

Import-Module Microsoft.Graph

4.Authenticate with Microsoft Graph

You need to authenticate your session with the appropriate permissions. The command below will prompt you to log in and grant the necessary permissions (you’ll need Directory.Read.All and AuditLog.Read.All scopes):

Connect-MgGraph -Scopes Directory.Read.All,AuditLog.Read.All

A sign-in window will appear where you need to enter your Microsoft Entra ID credentials. Please ensure you have the required permissions to access this data.

Please note that if you run the below Microsoft Graph PowerShell cmdlet by opening PowerShell as an Administrator, then you can see the Microsoft Intune Company Portal for Linux application under CA policy exclusion list.

Update-MgServicePrincipal -ObjectId "ab2090ac-f980-4517-ac00-a27a0f38573f"-Tags WindowsAzureActiveDirectoryCustomSingleSignOnApplication

Please refer to the below Screenshot from my test tenant where after running the above PowerShell command, I can see this application Microsoft Intune Company Portal for Linux under CA policy exclusion list.

Please let me know if you have any other queries. I am looking forward to your response.

Thank you again. Now I am able to select Microsoft Intune Company Portal for Linux Service Principal but it is not recognized and gets blocked by CA.

I tried now the things listed below to exclude the app:

• using filters
• exclude the service principal

Any idea why this fails? how I can allow the login Microsoft Intune Company Portal for Linux to login while enforcing CA?

My current CA rule looks like this:

{
    "conditions": {
        "applications": {
            "includeApplications": [
                "All"
            ],
            "excludeApplications": [
                "b743a22d-6705-4147-8670-d92fa515ee2b"
            ],
            "includeUserActions": [],
            "includeAuthenticationContextClassReferences": [],
            "applicationFilter": null,
            "globalSecureAccess": null
        },
        "clients": null,
        "users": {
            "includeUsers": [
                "All"
            ],
            "excludeUsers": [

            ],
            "includeGroups": [],
            "excludeGroups": [
            ],
            "includeRoles": [],
            "excludeRoles": [],
            "includeGuestsOrExternalUsers": null,
            "excludeGuestsOrExternalUsers": null
        },
        "clientApplications": null,
        "platforms": {
            "includePlatforms": [
                "linux"
            ],
            "excludePlatforms": []
        },
        "locations": null,
        "userRiskLevels": [],
        "signInRiskLevels": [],
        "insiderRiskLevels": null,
        "signInRiskDetections": null,
        "clientAppTypes": [
            "all"
        ],
        "times": null,
        "devices": null,
        "servicePrincipalRiskLevels": [],
        "authenticationFlows": null
    },
    "displayName": "CA112 Platform: Linux; App: All; Method: All; Action: Block",
    "grantControls": {
        "operator": "OR",
        "builtInControls": [
            "block"
        ],
        "customAuthenticationFactors": [],
        "termsOfUse": [],
        "authenticationStrength": null
    },
    "sessionControls": null,
    "state": "enabled"
}